Skip to content

Latest commit

 

History

History
23 lines (13 loc) · 923 Bytes

unknown-glibc.md

File metadata and controls

23 lines (13 loc) · 923 Bytes

Determine Unknown Glibc Version from Leaked Addresses

Author: PinkNoize

Result

  • Glibc version used by a process

Requirement

  • Address of 1 or more glibc functions

Steps

  1. Get the addresses of some glibc functions

    You can get these addresses however you want. Some examples include debug statements or an arbitrary memory read to read the addresses out of the .got.plt section.

  2. Compare the addresses to known glibc address offsets

    You should not do this manually. Use a tool like libc-database. The online version is at https://libc.rip/.

Notes

This technique is useful when you are supplied a challenge without a glibc ELF where exploitation would be simplified by having the glibc ELF. This can be combined with one_gadget to speed up the creation of shell dropping ROP chains.